Academics from three universities across Europe have disclosed today a new attack that impacts the integrity of data stored inside Intel SGX, a highly-secured area of Intel CPUs.
It was reported by three academics from three different universities across Europe that a new attack was re that affects the integrity of data stored in the highly-secured area of Intel CPUs called the Intel SGX. The attack exploits an interface which is in charge of controlling the voltage regulation of the Intel processor, this interface is something that many gamers will recognize as it is the same one that is used to overclock their CPUs. The attack is aptly named, Plundervolt.
How it works
Plundervolt only targets Intel Software Guard eXtensions (SGX). The Intel SGX, for those unfamiliar with it, is a powerful security feature that is found on all modern Intel CPUs that keeps very sensitive data for applications to ensure that other applications are unable to access it.
By using the CPU’s energy management interface, it is able cause some changes in the SGX data just by altering the electrical voltage and frequency of the SGX memory cells. This causes bugs and faults appear within the data and operations which SGX handles. Meaning, instead of destroying, Plundervolt sabotages output to weaken the encryption of SGX and even cause errors within apps that might have not been there before to exploit and steal data.
However, unlike other attacks, Plundervolt cannot be exploited remotely like luring users into a website and then being able to execute the attack. Plundervolt needs to run from an app of an infected hosts with root or admin privileges. So getting a successful attack may be harder compared to other attacks but once they are able to get in your system, they will be able to exploit your system much faster than most other attacks.
What Intel CPUs are infected and where can we get a fix?
According to Intel, the following CPU series are vulnerable to Plundervolt attacks:
Intel® 6th, 7th, 8 th, 9th & 10th generation CoreTM processors
Intel® Xeon® Processor E3 v5 & v6
Intel® Xeon® Processor E-2100 & E-2200 families
Plundervolt is nothing that end-users should worry about. It’s an attack vector that is of little interest for malware authors since it’s hard to automate at scale. It is, however, an attack vector that could be weaponized in targeted attacks, against specially selected targets. If Plundervolt is a serious threat depends on each user’s threat matrix.
For those who are looking for the update to fix this vulnerability, you may refer to the microcode and BIOS update here.
For any inquiries with regards to this vulnerability or any other security questions, you may call us at 8893-9515 and we would be happy to help you!